The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted external data.\n
Ingestion points: The skill reads user-provided arguments, PRD files, and existing database schema/DDL files (Step 1 in SKILL.md).\n
Boundary markers: No boundary markers or 'ignore embedded instructions' warnings are present to delimit the external content.\n
Capability inventory: The skill possesses the capability to write files to the output directory, edit project settings (jaan-to/config/settings.yaml), and execute shell commands.\n
Sanitization: The skill lacks sanitization, escaping, or validation logic for the content ingested from external files before processing it.\n- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands and source local scripts.\n
Evidence: The skill sources internal utility scripts (source "${CLAUDE_PLUGIN_ROOT}/scripts/lib/id-generator.sh" and source "${CLAUDE_PLUGIN_ROOT}/scripts/lib/index-updater.sh") to handle project metadata and ID generation.\n
Risk: It constructs shell commands like mkdir -p "$OUTPUT_FOLDER" where the path includes a slug variable derived from user-supplied entity names without explicit sanitization instructions for the agent.\n- [DYNAMIC_EXECUTION]: The workflow relies on dynamic execution patterns by sourcing external logic at runtime to update indexes and generate identifiers. While these are local utilities, the assembly of paths and slugs from user input for use in shell contexts presents a minor dynamic execution risk.

backend-data-model